Virus detecting method and device

Abstract

A virus detecting method and device are provided, where the method includes that the virus detecting device receives a network data stream carrying a portable execute (PE) file; calculates first identification information according to structure information of the PE file; matches the first identification information with virus identification information prestored in an antivirus database, and determines whether the PE file is an Archive file; if the PE file is an Archive file, calculates second identification information according to a data packet that carries a data part of the Archive file; and matches the second identification information with the virus identification information prestored in the antivirus database, and if the matching succeeds, determines that the Archive file is an Archive virus file. The present invention can effectively determine whether an Archive-type PE file is a virus file.

What is claimed is: 
     
       1. A virus detecting method, comprising:
 receiving a network data stream carrying a portable execute (PE) file; 
 obtaining a file header of the PE file using a data packet in the network data stream, wherein the file header comprises structure information of the PE file; 
 calculating first identification information using the structure information of the PE file; 
 determining, according to a correspondence between virus identification information prestored in an antivirus database and a file type and prestored in the antivirus database, whether the PE file is an Archive file when successfully matching the first identification information with the virus identification information, wherein the file type comprises an Archive file and a PE virus file; 
 acquiring, from the network data stream, a data packet that carries a data part of the Archive file when the PE file is an Archive file; 
 calculating second identification information using the data packet that carries the data part of the Archive file; and 
 determining, that the Archive file is an Archive virus file when successfully matching the second identification information with the virus identification information prestored in the antivirus database. 
 
     
     
       2. The method according to  claim 1 , wherein the method further comprises determining that the PE file is a PE virus file when the PE file is a non-Archive file. 
     
     
       3. The method according to  claim 1 , wherein acquiring, from the network data stream, the data packet that carries the data part of the Archive file, and calculating the second identification information using the data packet that carries the data part of the Archive file comprises:
 searching, in correspondence between the virus identification information and an Archive file form, for an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; 
 acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and 
 calculating the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file. 
 
     
     
       4. The method according to  claim 3 , wherein calculating the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file comprises:
 obtaining the data part of the Archive file using the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 calculating a hash value of the data part of the Archive file using a hash algorithm when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 obtaining, using the data packet that carries the data part of the Archive file, the data structure information that is part of the data part of the Archive file when the Archive file fond corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 calculating, using a hash algorithm, a hash value of the data structure information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; and 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information. 
 
     
     
       5. The method according to  claim 2 , wherein acquiring, from the network data stream, the data packet that carries the data part of the Archive file, and calculating the second identification information using the data packet that carries the data part of the Archive file comprises:
 searching, in correspondence between the virus identification information and an Archive file form and prestored in the antivirus database, for an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; 
 acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and 
 calculating the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file. 
 
     
     
       6. The method according to  claim 5 , wherein calculating the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file comprises:
 obtaining the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 calculating a hash value of the data part of the Archive file using a hash algorithm when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 obtaining, by means of reassembly according to the data packet that carries the data part of the Archive file, the data structure information comprised in the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 calculating, using a hash algorithm, a hash value of the data structure information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; and 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information. 
 
     
     
       7. The method according to  claim 1 , wherein calculating the first identification information according to the structure information of the PE file comprises:
 selecting at least two pieces of attribute information from the structure information of the PE file; 
 joining the at least two pieces of attribute information into a data block; 
 calculating a hash value of the data block using a hash algorithm; and 
 using the hash value as the first identification information. 
 
     
     
       8. A virus detecting device, comprising:
 a memory storing executable instructions, and 
 a processor coupled to the memory, wherein the instructions cause the processor to be configured to:
 receive a network data stream carrying a portable execute (PE) file; 
 obtain a file header of the PE file using a data packet in the network data stream, wherein the file header comprises structure information of the PE file; 
 
 calculate first identification information according to the structure information of the PE;
 determine, according to a correspondence between virus identification information prestored in an antivirus database and a file type and prestored in the antivirus database, whether the PE file is an Archive file when successfully matching the first identification information with the virus identification information, wherein the file type comprises an Archive file and a PE virus file; 
 acquire, from the network data stream, a data packet that carries a data part of the Archive file when the PE file is an Archive file; 
 calculate second identification information using the data packet that carries the data part of the Archive file; and 
 determine that the Archive file is an Archive virus file when successfully matching the second identification information with the virus identification information prestored in the antivirus database. 
 
 
     
     
       9. The device according to  claim 8 , wherein the processor is further configured to determine that the PE file is a PE virus file when the PE file is a non-Archive file. 
     
     
       10. The device according to  claim 8 , wherein the instructions further cause the processor to be configured to:
 search, in correspondence between the virus identification information and an Archive file form, for an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; 
 acquire, from the network data stream, the data packet that carries the data part of the Archive file; and 
 calculate the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file. 
 
     
     
       11. The device according to  claim 10 , wherein the instructions further cause the processor to be configured to:
 obtain the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 calculate a hash value of the data part of the Archive file using a hash algorithm when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 use the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 obtain the data structure information comprised in the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 calculate, using a hash algorithm, a hash value of the data structure information obtained by means of reassembly when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 use the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information. 
 
     
     
       12. The device according to  claim 9 , wherein the instructions further cause the processor to be configured to:
 search, in a correspondence between the virus identification information and an Archive file form and prestored in the antivirus database, for an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; 
 acquire, from the network data stream, the data packet that carries the data part of the Archive file; and 
 calculate the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file. 
 
     
     
       13. The device according to  claim 12 , wherein the instructions further cause the processor to be configured to:
 obtain the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 calculate a hash value of the data part of the Archive file using a hash algorithm when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 use the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 obtain the data structure information comprised in the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 calculate, using a hash algorithm, a hash value of the data structure information obtained by means of reassembly when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; and 
 use the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information. 
 
     
     
       14. The device according to  claim 8 , wherein the instructions further cause the processor to be configured to:
 select at least two pieces of attribute information from the structure information of the PE file; 
 join the at least two pieces of attribute information into a data block; and 
 calculate, using a hash algorithm, a hash value of the data block; and 
 use the hash value as the first identification information. 
 
     
     
       15. A virus detecting device, comprising:
 a receiver, 
 a memory; and 
 a processor coupled to the receiver and the memory, 
 wherein the receiver is configured to receive a network data stream carrying a portable execute (PE) file, 
 wherein the memory is configured to store code, and 
 wherein the processor is configured to read the code stored in the memory and execute the following operations:
 obtaining a file header of the PE file using a data packet in the network data stream received by the receiver, wherein the file header comprises structure information of the PE file; 
 calculating first identification information according to the structure information of the PE file; 
 matching the first identification information with virus identification information prestored in an antivirus database, and when the matching succeeds, determining, according to a correspondence between the virus identification information and a file type and prestored in the antivirus database, whether the PE file is an Archive file, wherein the file type comprises an Archive file and a PE virus file; 
 acquiring, from the network data stream, a data packet that carries a data part of the Archive file when the PE file is an Archive file; 
 calculating second identification information using the data packet that carries the data part of the Archive file; and 
 determining that the Archive file is an Archive virus file when successfully matching the second identification information with the virus identification information prestored in the antivirus database, determining. 
 
 
     
     
       16. The device according to  claim 15 , wherein the processor being configured to acquire, from the network data stream, the data packet that carries the data part of the Archive file, and calculate the second identification information according to the data packet that carries the data part of the Archive file comprises:
 searching, in correspondence between the virus identification information and an Archive file form, for an Archive file form corresponding to the first identification information, wherein the Archive file form comprises an Archive file whose data part comprises data structure information and an Archive file whose data part does not comprise data structure information; 
 acquiring, from the network data stream, the data packet that carries the data part of the Archive file; and 
 calculating the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file. 
 
     
     
       17. The device according to  claim 16 , wherein the processor being configured to calculate the second identification information using the Archive file form corresponding to the first identification information and the data packet that carries the data part of the Archive file comprises:
 obtaining the data part of the Archive file by means of reassembly according to the data packet that carries the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 calculating a hash value of the data part of the Archive file using a hash algorithm when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part does not comprise data structure information; 
 obtaining, by means of reassembly according to the data packet that carries the data part of the Archive file, the data structure information comprised in the data part of the Archive file when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; 
 calculating, using a hash algorithm, a hash value of the data structure information obtained by means of reassembly when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information; and 
 using the hash value as the second identification information when the Archive file form corresponding to the first identification information is the Archive file whose data part comprises data structure information. 
 
     
     
       18. The device according to  claim 15 , wherein the processor being configured to calculate the first identification information according to the structure information of the PE file comprises:
 selecting at least two pieces of attribute information from the structure information of the PE file; 
 joining the at least two pieces of attribute information into a data block; 
 calculating a hash value of the data block using a hash algorithm; and 
 using the hash value as the first identification information. 
 
     
     
       19. The device according to  claim 15 , wherein the processor is further configured to determine that the PE file is a PE virus file when the PE file is a non-Archive file.